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CLAIM AMENDMENTS 

This listing of claims will replace all prior versions and listings of claims in 
the application. 
Listing of Claims 

1. (Currently Amended) A method of detecting denial of service (DoS). attacks in 
an Internet accessible network having at least one proxy server incorporating a 
session initiation protocol (SIP), said SIP includin g ses si o n i i iifek4^^^^^ 
isfefeides INVITE (1NV) messages that request set-up of an Internet telephone call 

and S£P— 180 Ringing mes sage messages fliat indicate ringing, the method 
comprising the following stepsH>f: 

ag gregating said INVITE, messages and said 180 Ringing messages for sill 
users on said Internet accessible network: 

detecting an imbalance between a^-eee^H^ ^a number of said SI^INVITE 
and SI-iM.80 Ringing-H^e^St>^ messages resulting from a^vB^il^c>^en-ke DoS 
attack; and 

providing an indication of the presence of a current DoS attack on said proxy 
server based on detection of said imbalance. 

2. (Currently Amended) The method of dotoGting - dcnial of se r vice; at ta ck s m-im 
tn^feewaet- a e c es&iklc ncfcw wk-a s dcfm ed-in-claim 1, 
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wherein a number ^tbe-a-tt«beg",(H), of INVITE messages including credentials 
that are sent from a user client in response to an authentication required £41)7-) 
message from the proxy server, said credentials being information used by the 
proxy server to authenticate the. INVITE messages, are removed from the 
accounting before the balance is, tested such that when the equation: 

INVo [[to]] + INVc - H = Niso 
where INV 0 is the number of INVITE messages without said credentials, 
INVc is the number of INVITE messages with said credentials, and 
Niso is the number of said 180 messages, 
is not true within a predetermined margin of error, 

then the presence of a deftiat--e^ee=gvioe ^DoS attack on the proxy server is indicated 
by the inequality. 

3. (Currently Amended) The method 0f de*ed*i^ 

fertCT n bt a c o oXr fiihlo network as dc&i^ed-k^claim 2, further including the following 
step: 

causing said proxy server to maintain a call information table for 
determining the value of H. 



4. (Canceled). 
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5. (Currently Amended) A system for detecting denial of service (DoS) attacks 
against session initiation protocol elements in a Internet accessible network having 
at least one proxy server , said system comprising: 

means for aggr egating sai d INVITE messages and said 180 Rin ging inessaH to 

for all users on said Internet accessible network: and 

means, within wfee^eiB-said proxy server, includes means for determining if 
the number of INVITE messages including credentials (INV C ) sent to said proxy 
server from user clients in response to an authentication requirement exceeds a 
^K^d^eimiaedr4eye3 ~niunber of said 180 Ringing messages that indicates a DoS 
attack,, said credentials being information used by the proxy server to authenticate 
the INVITE messages. 

6. (Curre ritly Amended) A system for detecting denial of service (DoS) attacks in 
an Internet accessible network having at least one proxy server incorporating 
session initiation protocol (SIP), said system comprising: 

means for aggregating said INVITE messages and said 180 Ringing messages 

for all users on said, Internet accessible network: and 

means, within wherein-said proxy server, ineted.es mcaas-for detecting an 
imbalance between «Haeeettafc*ff ji number of Sfg- said INVITE and StP- said 180 
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Ringing messages , the unbalance iii d ictating-^ presence of a current 

de^ja^feeyv-ke- DoS a ttack on said proxy server. 

7 . (Currently Amended) The system of AngyefcCH^ 

^KM-weirk a^clai nyid in claim 5, wherein said means for determining creates a call- 
info table for use in tracking said INVITE messages. 

8. (Currently Amended) The system of A^^tem^ 

-Re£«&i4t-&^^ 6, wherein said means for detecting creates a call-info 

table. 



